1. Risk Management - Manage them or they will manage you...
CSE403 Lecture #3
Risk Management - Manage them or they will manage you...

2. Risk Management Identify, Address, and Eliminate
Levels of Risk Management
Crisis Management
Fix on Failure
Risk Mitigation
Prevention
Elimination of Root Causes

3. Risk Management (cont)
Activities of Risk Management
Risk Assessment
Identification
Analysis
Prioritization
Risk Control
Management Planning
Resolution
Monitoring

4. Risk Identification
Risks are things that adversely effect your ability to deliver a produce on schedule and within budget.
They aren’t necessarily show stoppers
Aren’t guaranteed to cause problems, but they might
Can be things that don’t seem related to the actual software engineering process

5. Common Risks (from McConnell’s book)
Feature creep
Requirements or developer gold-plating
Shortchanged quality
Overly optimistic schedules
Inadequate design
Silver-bullet syndrome
Weak personnel

6. Risk Analysis Find your Risk Exposure (RE)
RE = ‘probability of each risk causing trouble’ * ‘the amount of trouble that risk will cause’
The project’s total RE is the sum of the RE for all of the project’s risks
Can think of this as the expected loss due to risks
Make the best estimates you can in this phase

7. A Risk Exposure Example

8. Risk Prioritization
Use your intuition and the RE table to choose an order for addressing risks
Should attack risks that add a lot to RE and ones that have large penalties
Remember that the table contains estimates

9. Risk Prioritization Example
Rational Rose
Database Communications
CGI support
Group communication

10. Risk Management Planning
Develop a plan to handle each of the high priority risks
A paragraph or two saying
Who is responsible for the risk
What will that person do
What will the team do if the risk materializes
etc

11. Risk Resolution Avoid the risk
Transfer the risk (to someone with more experience, or out of the critical path)
Get more information about the risk
Assume the risk (if it’s small)
Publicize the risk
Control the Risk (allocate more resources)

12. Risk Monitoring Evaluate new risks as they appear
Check off old risks as they resolve
Top ten risk list
keep a list of the highest risks in a public place
Update it frequently(weekly?)
Assign a risk officer